問91
頻出度★★★
次の作業a～dのうち, リスクマネジメントにおける, リスクアセスメントに含まれるものだけを全て挙げたものはどれか。 a 脅威や脆弱性などを使ってリスクレベルを決定する。 b リスクとなる要因を特定する。 c リスクに対してどのように対応するかを決定する。 d リスクについて対応する優先順位を決定する。
令和3年度 ITパスポート試験 問91
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 91
Incorrectア
With only 'a, b', task d (risk evaluation), which sets the priority order, is missing. Since d is also a step of assessment, this fails the condition of listing all included items and is thus incomplete.
- イ
正解 Within risk management, risk assessment refers to the three steps 'risk identification → risk analysis → risk evaluation' (JIS Q 31000/ISO 31000). Task a determines the risk level using threats, vulnerabilities, and the like, so it is 'risk analysis'; task b identifies the factors that constitute risks, so it is 'risk identification'; task d determines the priority order of response, so it is 'risk evaluation'. All three are included in assessment. In contrast, task c, 'deciding how to respond to the risks', is 'risk treatment', which is carried out after assessment and is therefore not included. Hence, listing only what is included in assessment gives a, b, and d, and the correct answer is イ.
Incorrectウ
'a, c, d' is wrong because it includes c. Task c, 'deciding how to respond to the risks', belongs to 'risk treatment', the stage after assessment, and is not part of assessment. It also wrongly omits b (risk identification).
Incorrectエ
In 'c, d', task c is 'risk treatment' outside assessment and is inappropriate. Moreover, it entirely omits a (risk analysis) and b (risk identification), which do belong to assessment, making it almost the opposite choice.
ここがポイント
- Risk assessment = the three steps 'risk identification, risk analysis, risk evaluation'. The subsequent 'risk treatment' is a separate step and is not part of assessment (JIS Q 31000/ISO 31000).
- Mapping of each task: identifying factors = risk identification; computing the risk level from threats and vulnerabilities = risk analysis; setting the response priority = risk evaluation; deciding how to respond = risk treatment.
用語